Deprecation warning on enable_binary_authorization

[wyardley]

TL;DR

Module creates a Deprecated in favor of binary_authorization warning with latest Google provider

Expected behavior

No deprecation warning

Observed behavior

│ Warning: Argument is deprecated
│ 
│   with module.gke.google_container_cluster.primary,
│   on .terraform/modules/gke/modules/beta-private-cluster/cluster.tf line 121, in resource "google_container_cluster" "primary":
│  121:   enable_binary_authorization = var.enable_binary_authorization
│ 
│ Deprecated in favor of binary_authorization.

Terraform Configuration

module "gke" {
  source                       = "terraform-google-modules/kubernetes-engine/google//modules/beta-private-cluster"
  version                      = "22.0.0"
  project_id                   = "foo"
  name                         = "foo"
  regional                     = true
  region                       = "us-west2"
  // [...]
}

Terraform Version

Terraform v1.2.5
on darwin_arm64
+ provider registry.terraform.io/fluxcd/flux v0.15.2
+ provider registry.terraform.io/gavinbunney/kubectl v1.14.0
+ provider registry.terraform.io/hashicorp/google v4.28.0
+ provider registry.terraform.io/hashicorp/google-beta v4.29.0
+ provider registry.terraform.io/hashicorp/kubernetes v2.12.1
+ provider registry.terraform.io/hashicorp/random v3.3.2
+ provider registry.terraform.io/integrations/github v4.27.0

### Additional information

_No response_

[bharathkkb]

Thanks for the report @wyardley. Happy to review a PR swapping this.

[wyardley]

Thanks for the report @wyardley. Happy to review a PR swapping this.

Sure - can do, just wanted to make sure there weren't min version / compatibility concerns.

[wyardley]

Obviously, will have to work on regenerating, and updating tests if needed, but is the rough idea something like this?
The docs are not super helpful, but that's my guess based on https://github.com/hashicorp/terraform-provider-google/search?q=PROJECT_SINGLETON_POLICY_ENFORCE

--- a/autogen/main/cluster.tf.tmpl
+++ b/autogen/main/cluster.tf.tmpl
@@ -152,6 +152,14 @@ resource "google_container_cluster" "primary" {
   default_max_pods_per_node = var.default_max_pods_per_node
   enable_shielded_nodes       = var.enable_shielded_nodes
   enable_binary_authorization = var.enable_binary_authorization
+
+  dynamic "binary_authorization" {
+    for_each = var.enable_binary_authorization ? [var.enable_binary_authorization] : []
+    content {
+      evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
+    }
+  }
+
   {% if beta_cluster %}
   enable_intranode_visibility = var.enable_intranode_visibility
   enable_kubernetes_alpha     = var.enable_kubernetes_alpha

[wyardley]

Also, is the preference to keep the module interface consistent (enable_binary_authorization = true)? That's probably the simplest / narrowest fix, and I believe should be non-breaking, though it doesn't preserve consistency between the module interface and the provider's.

I'm not sure what minimum version is required for this, but since the module requires >= 4.25.0, guessing we're good there?

[wyardley]

Thanks for the report @wyardley. Happy to review a PR swapping this.

Hi @bharathkkb
would you mind taking a look at #1332 when you have a chance?